I think we can simplify this - user.has_perm always returns True for superusers.